Understanding File Upload Vulnerabilities in Web App Penetration Testing | 2023

Unraveling the Intricacies of File Upload Vulnerabilities in Bug Bounty Hunting | Karthikeyan Nagaraj

What are file upload vulnerabilities?

• File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size.
• Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.

What is the impact of file upload vulnerabilities?

The impact of file upload vulnerabilities generally depends on two key factors:

• Which aspect of the file the website fails to validate properly, whether that be its size, type, contents, and so on.
• What restrictions are imposed on the file once it has been successfully uploaded.

In the worst case scenario, the file’s type isn’t validated properly, and the server configuration allows certain types of file (such as .php and .jsp) to be executed as code. In this case, an attacker could potentially upload a server-side code file that functions as a web shell, effectively granting them full control over the server.

If the filename isn’t validated properly, this could allow an attacker to overwrite critical files simply by uploading a file with the same name. If the server is also vulnerable to directory traversal, this could mean attackers are even able to upload files to unanticipated locations.

Failing to make sure that the size of the file falls within expected thresholds could also enable a form of denial-of-service (DoS) attack, whereby the attacker fills the available disk space.

How do file upload vulnerabilities arise?

• Given the fairly obvious dangers, it’s rare for websites in the wild to have no restrictions whatsoever on which files users are allowed to upload.
• More commonly, developers implement what they believe to be robust validation that is either inherently flawed or can be easily bypassed.

For example, they may attempt to blacklist dangerous file types, but fail to account for parsing discrepancies when checking the file extensions. As with any blacklist, it’s also easy to accidentally omit more obscure file types that may still be dangerous.

In other cases, the website may attempt to check the file type by verifying properties that can be easily manipulated by an attacker using tools like Burp Proxy or Repeater.

Ultimately, even robust validation measures may be applied inconsistently across the network of hosts and directories that form the website, resulting in discrepancies that can be exploited.

How do web servers handle requests for static files?

Before we look at how to exploit file upload vulnerabilities, it’s important that you have a basic understanding of how servers handle requests for static files.

Historically, websites consisted almost entirely of static files that would be served to users when requested. As a result, the path of each request could be mapped 1:1 with the hierarchy of directories and files on the server’s filesystem. Nowadays, websites are increasingly dynamic and the path of a request often has no direct relationship to the filesystem at all. Nevertheless, web servers still deal with requests for some static files, including stylesheets, images, and so on.

The process for handling these static files is still largely the same. At some point, the server parses the path in the request to identify the file extension. It then uses this to determine the type of the file being requested, typically by comparing it to a list of preconfigured mappings between extensions and MIME types. What happens next depends on the file type and the server’s configuration.

• If this file type is non-executable, such as an image or a static HTML page, the server may just send the file’s contents to the client in an HTTP response.
• If the file type is executable, such as a PHP file, and the server is configured to execute files of this type, it will assign variables based on the headers and parameters in the HTTP request before running the script. The resulting output may then be sent to the client in an HTTP response.
• If the file type is executable, but the server is not configured to execute files of this type, it will generally respond with an error. However, in some cases, the contents of the file may still be served to the client as plain text. Such misconfigurations can occasionally be exploited to leak source code and other sensitive information. You can see an example of this in our information disclosure learning materials.

Exploiting unrestricted file uploads to deploy a web shell

From a security perspective, the worst possible scenario is when a website allows you to upload server-side scripts, such as PHP, Java, or Python files, and is also configured to execute them as code. This makes it trivial to create your own web shell on the server.

If you’re able to successfully upload a web shell, you effectively have full control over the server. This means you can read and write arbitrary files, exfiltrate sensitive data, even use the server to pivot attacks against both internal infrastructure and other servers outside the network. For example, the following PHP one-liner could be used to read arbitrary files from the server’s filesystem:

<?php echo file_get_contents('/path/to/target/file'); ?>

Unmasking File Upload Vulnerabilities

File Upload Vulnerabilities are a subset of security weaknesses that attackers can exploit to upload malicious files to a web application server. These files can then be executed, leading to various forms of cyberattacks. Here, we dive into the intricacies of these vulnerabilities:

1. Direct File Upload

Direct File Upload Vulnerability is the most straightforward form. Attackers upload malicious files directly to the server without any checks or restrictions. This often happens due to lax server-side validation.

2. Executable File Upload

In Executable File Upload Vulnerabilities, attackers upload files that contain malicious code, such as PHP, ASP, or JavaScript files. If the application does not properly validate file types, these can be executed, compromising the server.

3. Client-Side Validation Bypass

When web applications rely solely on client-side validation, attackers can easily bypass these checks. They may manipulate HTTP requests to upload malicious files.

4. File Type and Content Validation

Some applications only check the file extension but not the content, allowing attackers to upload files with false extensions (e.g., renaming a .php file to .jpg).

Detecting File Upload Vulnerabilities

Detecting these vulnerabilities is crucial for a robust security posture:

1. File Type Verification

Implement server-side file type and content validation to ensure uploaded files match their stated type.

2. Secure File Storage

Store uploaded files outside the web root directory to prevent direct execution.

3. User Authentication and Authorization

Ensure only authorized users can upload files, and restrict the file upload functionality to specific roles.

4. Regular Security Audits

Conduct frequent security audits and penetration testing to identify and patch vulnerabilities promptly.

FAQs (Frequently Asked Questions)

Q1. Can File Upload Vulnerabilities lead to complete server compromise?

Yes, if attackers successfully upload and execute malicious files, they can potentially compromise the entire server.

Q2. Are all file types equally risky in File Upload Vulnerabilities?

No, executable file types like .php or .asp pose a higher risk than non-executable types like .jpg or .pdf.

Q3. How can I prevent File Upload Vulnerabilities?

Implement thorough server-side validation, secure file storage practices, and proper user authentication and authorization.

Q4. Is client-side validation alone sufficient to protect against File Upload Vulnerabilities?

No, client-side validation can be bypassed easily. Server-side validation is essential.

Q5. How often should I perform security audits for my web application?

Regular security audits should be conducted, at least annually or whenever there are significant updates or changes to the application.

Conclusion

File Upload Vulnerabilities are a critical concern in web application security. Understanding the various types, detection methods, and mitigation strategies is vital for safeguarding your digital assets. In an era where cyber threats are constantly evolving, proactive security measures are your best defense against potential attacks.